The connector
The MCP connector
An agent's assistant, talking to their own CRM.
A broker pastes one URL into their Claude (or their ChatGPT), signs in to Orkasa, approves a few permissions — and from then on asks about their files and acts on them, in their own words.
https://orkasa.app/api/mcp
It is not a second API. It goes through the same authentication as
/api/v1, the same permissions, the same rate limit,
and — for the four tools that write — the same cores the REST routes call.
What changes is the shape of the answer: files and day-plans already composed, instead of table rows. The caller is a language model, and every join you make it do by hand is a join it can get wrong.
The nine tools
| Tool | Permission | What it answers |
|---|---|---|
buscar | leads:read | "Do you have Mrs Herrera's number?" — clients and properties by name, phone, email, address. |
ver_expediente | leads:read | "How is the Felipe deal going?" — the whole file: operations, stage, property, viewings, offers, documents, latest messages, and the Copilot's next move. |
mi_jornada | operations:read | "What do I have today?" — the next moves, own turn first, most overdue in front. |
buscar_propiedades | properties:read | "What do I have in Chapinero under 600 million?" |
agenda | viewings:read | "What viewings do I have this week?" |
crear_lead | leads:write | A dictated contact, with its buy or rent operation opened. |
agendar_visita | viewings:write | A viewing, confirmed in the brokerage's time zone. |
avanzar_etapa | operations:write | One pipeline step, gates included. |
registrar_oferta | offers:write | An offer received, without accepting it or moving the stage. |
Details for each are in Tools.
Tool names are in Spanish: that is what the model matches against the
broker's intent. Field names stay the ones from /api/v1. A lead_id
that meant one thing here and another in REST is the kind of drift nobody
notices until an integration breaks.
The protocol
Streamable HTTP, stateless. Five methods: initialize,
notifications/initialized, ping, tools/list, tools/call. No session, no
SSE stream, nothing to resume: each POST carries its own token and answers on
its own, so two consecutive calls can land on two different instances without
anyone noticing. The GET a stateful server would open answers 405.
initialize answers before the token: a client that has no credential yet
must be able to learn which protocol version we speak, and answering it 401
sends some clients into a retry loop instead of into the OAuth flow.
Check it by hand
curl -s https://orkasa.app/.well-known/oauth-protected-resource | jq
curl -s -i -X POST https://orkasa.app/api/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -12The second returns 401 with the challenge that starts discovery — see
Connect an assistant.